Our dependence on cyber-connectivity

November 2018 Editor's Choice, Cyber Security, Government and Parastatal (Industry)

What would your life (or even a day) be like without all the amenities we take for granted? Our nation’s cities and critical infrastructure are almost totally reliant on the Internet.

Craig Rosewarne
Craig Rosewarne

A doomsday scenario could begin with waking up to no electricity and water. You attempt to contact the office, but all telecoms are down. Thank heavens you can get to the office you surmise, but alas not. Petrol stations are closed, all banking systems are offline, highways are snarled with out of gas or hacked vehicles. Supermarkets are being invaded and looted as panic sets in. Emergency services collapse with medical facilities in particular being forced to turn away patients.

As the days and weeks pass, money begins to lose its value and people begin to return to trading in gold and other precious commodities. The black-market booms and simple items such as batteries, LP gas, solar panels, bottled water, etc. suddenly begin to be much sought-after items.

Impossible you may say. However, unless we all play our part to protect our infrastructure, the above is a very real scenario.

Just ask Ukrainians who received a small dose of state sponsored attacks from 2015 onwards. Virtually every sector of their nation’s critical infrastructure has been targeted, namely energy, media, military, finance and political system.

“If you close your eyes to facts, you will learn through accidents” – African proverb
“If you close your eyes to facts, you will learn through accidents” – African proverb

Safeguarding the nation’s critical infrastructure

The health, safety, security, economic well-being of citizens, effective functioning of government and perhaps even the survival of the industrialised world relies heavily upon interconnected critical systems. A country may experience widespread disruption, or even experience loss of human life if these systems become inoperable.

The reliability, stability and protection of interconnecting information infrastructures have become key to the operation of a nation’s critical systems. National Critical Information Infrastructures (CII) include information infrastructures, which support essential components vital to a national economy.

They usually comprise of a number of different infrastructures, interconnections and critical information flows between them. Traditionally closed Operational Technology (OT) systems are now being given IP addresses. Terms such as Industry 4.0, artificial intelligence, autonomous vehicles and Internet of Things (IoT) are now opening up all sectors to cyberspace. This allows cyber threats to make their way out of traditional back-office systems and into critical infrastructures such as power generation, transportation and other automation systems. Like all developing countries, South Africa has an increasing number of interconnected electronic systems.

Not only a challenge for government

Due to mounting pressure from both external and internal threats, South African organisations responsible for critical infrastructure need to have a consistent and iterative risk-based approach towards identifying, assessing and managing cybersecurity risk. This needs to become a priority, regardless of the organisation’s size, threat exposure or cybersecurity sophistication. Table 1 highlights key critical infrastructure stakeholders across the public and private sectors in SA.

Table 1.
Table 1.

An approach for securing our critical infrastructure

Although South African organisations have made great strides in information security in general, additional measures are needed to protect our national CII.

1. Prevent

Utilise a Threat Intelligence approach to predict the most likely attacks, targets and methods. Prevent or deter attacks so that no loss is experienced. Develop organisational understanding in order to manage cybersecurity risk to systems, assets, data and capabilities. Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services.

2. Detect

Develop a capable threat detection capability: trained staff, appropriate monitoring processes and implement technology to identify vulnerabilities or the occurrence of a cybersecurity event.

3. Respond

Utilise an effective incident management framework and establish a business-aligned incident response team. Develop incident procedures, ‘battle guides’ and run simulation exercises to allow a rapid response to incidents.

4. Recover

Develop and implement the appropriate activities to maintain plans for resilience. Restore any capabilities or services that were impaired by a cybersecurity event.

Valuable lessons learned

Critical Information Infrastructure Protection (CIIP) is the shared responsibility of both the public and private sector.

• The most effective way to secure a business is to use a combination of layered cyber and physical information in addition to human security measures.

• Measures should be proportionate to the expected threat and risk profile of your organisation, as well as the specific industry and location of operations.

• It is not possible to protect all assets at all times. Prioritise the key areas to protect first.

• Security is more cost effective when incorporated into longer-term planning.

For more information contact Wolfpack Information Risk, +27 11 794 7322, info@wolfpackrisk.com, www.wolfpackrisk.com





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

FortiGuard labs reports disruptive shift of cyber threats
Editor's Choice
Threat intelligence from the second half of 2020 demonstrates an unprecedented cyber-threat landscape where cyber adversaries maximised the constantly expanding attack surface to scale threat efforts around the world. Adversaries proved to be highly adaptable, creating waves of disruptive and sophisticated attacks.

Read more...
Turnstar ramps up countermeasures
Turnstar Systems Editor's Choice Access Control & Identity Management News Products
Turnstar has developed and patented an early warning and deterrent system which will alert security, and anyone nearby, of any attempt to place ramps over the raised spikes.

Read more...
The state of the distribution market
ESDA (Electronic Security Distributors Association Bosch Building Technologies Dark Horse Distribution Elvey Security Technologies Regal Distributors SA G4S Secure Solutions SA Editor's Choice Security Services & Risk Management
The distribution industry has evolved over the years and its current challenges simply mean another change is in the wind, for those who can take the next step.

Read more...
The cities best facilitating remote work
Editor's Choice
Study uses data to reveal which global cities are most accessible and attractive for remote workers by assessing factors related to employment compliance, living costs, infrastructure and liveability, in addition to showing current location trends.

Read more...
Training that delivers
Technews Publishing Leaderware ESDA (Electronic Security Distributors Association BTC Training Africa Editor's Choice Security Services & Risk Management Conferences & Events Training & Education
Hi-Tech Security Solutions hosted a virtual conversation to address the challenges and solutions related to effective and measurable training and education in the security industry.

Read more...
Premium forensic analytics
Milestone Systems News CCTV, Surveillance & Remote Monitoring Government and Parastatal (Industry)
With the introduction of XProtect Rapid REVIEW, powered by BriefCam, Milestone’s customers will be able to accelerate investigations and find what they are looking for with speed and accuracy.

Read more...
The importance of traceable records
Technews Publishing Editor's Choice Security Services & Risk Management
Traceable records streamline performance management, training, evidence records and reduce fraud, corruption and criminal activities.

Read more...
Intelligently adapting African cities for a better as well as a safer life
Government and Parastatal (Industry) Cyber Security
Smart buildings and cities therefore require as much a security-centric approach as they do an environmentally sustainable one.

Read more...
The importance of staying up to date
Access Control & Identity Management Government and Parastatal (Industry)
Africa’s cyber threat landscape is constantly evolving, with government’s facing a range of digital threats from espionage, critical infrastructure sabotage, organised crime and combat innovation.

Read more...
Smart city, smarter security
Government and Parastatal (Industry) Cyber Security
Henk Olivier, MD of Ozone Information Technology Distribution, unpacks the importance of smart and secure in the city of the future.

Read more...